What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Window User Profile changes to debugging

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I ran a virus scan on my laptop and found nothing on it, but something is changing my local user profile password. Since it has started doing this (about 1 week ago) my password has been changed about 5 times. Now when logging into email my outlook exchange server keeps asking me for the account pwd, I enter it and check save password but everytime I reboot it does the same thing. Hopefully someone has heard of this before. I am also posting my logs. Thanks Chris DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 19:32:03.65 on Tue 06/29/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2003.1503 [GMT -5:00] AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe C:\WINDOWS\system32\ccs.exe svchost.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe C:\WINDOWS\system32\AESTFltr.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\DellTPad\Apoint.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Cisco Aironet\ADU.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\PFU\ScanSnap\CardMinder V3.2\CardLauncher.exe C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\conwellc\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe mRun: [Apoint] c:\program files\delltpad\Apoint.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [ADU] "c:\program files\cisco aironet\ADU.exe" -nogui mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [Sprint SmartView] "c:\program files\sprint\sprint smartview\SprintSV.exe" -a mRun: [RDVCHG] "c:\program files\sprint\sprint smartview\RDVCHG.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\cardmi~1.lnk - c:\program files\pfu\scansnap\cardminder v3.2\CardLauncher.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\conver~1.lnk - c:\program files\pfu\scansnap\organizer\PfuSsOrgOcrChk.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\scansn~1.lnk - c:\program files\pfu\scansnap\driver\PfuSsMon.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{14fcfe7c-ab86-428a-9d2e-bfb6f5a7aa6e}\Icon3E5562ED7.ico StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe mPolicies-explorer: NoWelcomeScreen = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: NtlxVideoCtrl - hxxp://192.168.21.111/NtlxVideoCtrl.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} - hxxp://xserv.dell.com/DellDriverScanner/DellSystem.CAB DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll ============= SERVICES / DRIVERS =============== R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-10-29 108392] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2009-10-29 108392] R2 CdpPacket;Cisco Discovery Protocol Packet Driver;c:\windows\system32\drivers\CdpPacket.sys [2007-5-9 35692] R2 SlingAgentService;SlingAgentService;c:\program files\sling media\slingagent\SlingAgentService.exe [2009-9-25 93960] R2 SPCD;Spanlink Packet Capture Driver;c:\windows\system32\drivers\spcd.sys [2010-2-25 47360] R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2009-10-29 2477304] R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-2-24 112512] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-27 102448] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2010-2-24 109568] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100629.020\NAVENG.SYS [2010-6-29 85552] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100629.020\NAVEX15.SYS [2010-6-29 1347504] S3 AmDriver;AmDriver;c:\windows\system32\AmDriver.sys [2010-3-9 8192] S3 Amtrans;AirMagnet Analyzer Protocol;c:\windows\system32\drivers\Amtrans.sys [2010-3-9 58841] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2009-10-29 23888] S3 CSCO21;Cisco Aironet 802.11a/b/g Wireless Adapter Service;c:\windows\system32\drivers\csco21.sys [2010-2-24 486272] S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2009-9-10 20480] S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2009-9-10 174336] S3 sage;Cognio Mobile Spectrum Sensor Driver;c:\windows\system32\drivers\sage.sys [2010-3-9 8192] S3 SASENUM;SASENUM;\??\c:\docume~1\admini~1\locals~1\temp\sas_selfextract\sasenum.sys –> c:\docume~1\admini~1\locals~1\temp\sas_selfextract\SASENUM.SYS [?] S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344] =============== Created Last 30 ================ 2010-06-29 19:09:05 1120 ——w- C:\safecd.tgz 2010-06-29 00:01:05 0 d—–w- c:\docume~1\conwellc\applic~1\Sprint 2010-06-29 00:00:47 27072 —-a-w- c:\windows\system32\drivers\PCASp50.sys 2010-06-28 23:58:23 0 d—–w- c:\program files\Sprint 2010-06-28 23:58:23 0 d—–w- c:\program files\Novatel Wireless 2010-06-27 18:28:47 3253 —-a-w- c:\windows\system32\wbem\Outlook_01cb162694dbba6c.mof 2010-06-27 18:26:37 3253 —-a-w- c:\windows\system32\wbem\Outlook_01cb16264736c572.mof 2010-06-27 13:09:02 0 d–h–w- c:\windows\msdownld.tmp 2010-06-27 13:08:55 0 d—–w- c:\windows\Logs 2010-06-27 12:58:45 0 d—–w- c:\program files\common files\DivX Shared 2010-06-27 12:57:43 0 d—–w- c:\program files\DivX 2010-06-27 12:57:31 0 d—–w- c:\docume~1\alluse~1\applic~1\DivX 2010-06-26 02:52:51 0 d—–w- c:\program files\Windows Installer Clean Up 2010-06-24 19:54:01 0 d-sh–w- c:\documents and settings\conwellc\IECompatCache 2010-06-24 01:59:37 0 d-sh–w- c:\documents and settings\conwellc\PrivacIE 2010-06-24 01:28:37 0 d-sh–w- c:\documents and settings\conwellc\IETldCache 2010-06-23 23:42:08 0 d—–w- c:\windows\ie8updates 2010-06-23 23:39:00 0 dc-h–w- c:\windows\ie8 2010-06-23 23:36:38 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2010-06-23 23:36:37 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll 2010-06-23 23:36:37 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2010-06-23 23:36:13 41984 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2010-06-23 02:16:55 1374 —-a-w- c:\windows\imsins.BAK 2010-06-23 01:48:31 0 d—–w- c:\program files\common files\Deterministic Networks 2010-06-23 00:30:23 0 d-sha-r- C:\cmdcons 2010-06-23 00:29:28 98816 —-a-w- c:\windows\sed.exe 2010-06-23 00:29:28 77312 —-a-w- c:\windows\MBR.exe 2010-06-23 00:29:28 256512 —-a-w- c:\windows\PEV.exe 2010-06-23 00:29:28 161792 —-a-w- c:\windows\SWREG.exe 2010-06-23 00:15:15 1146536 —-a-w- C:\ccsetup232_slim.exe 2010-06-23 00:11:00 113858 —-a-w- C:\MGlogs.zip 2010-06-23 00:10:56 0 d—–w- C:\MGtools 2010-06-23 00:10:45 2395098 —-a-w- C:\MGtools.exe 2010-06-22 21:35:35 0 d—–w- c:\docume~1\alluse~1\applic~1\AT&T 2010-06-22 21:05:36 0 d—–w- c:\program files\Free Window Registry Repair 2010-06-22 20:31:51 0 d—–w- c:\docume~1\alluse~1\applic~1\Sprint 2010-06-22 20:24:48 0 d—–w- c:\docume~1\alluse~1\applic~1\Novatel Wireless 2010-06-22 20:14:42 17920 —-a-w- c:\windows\system32\apintfnt.dll 2010-06-22 20:14:33 0 d—–w- c:\docume~1\conwellc\applic~1\Sierra Wireless 2010-06-22 20:12:15 0 d—–w- c:\program files\Sierra Wireless 2010-06-22 13:46:49 0 d—–w- c:\docume~1\conwellc\applic~1\Windows Search 2010-06-22 13:13:05 0 d—–w- c:\windows\pss 2010-06-22 01:43:45 1594 —-a-w- c:\windows\VPNUnInstall.MIF 2010-06-22 01:35:18 0 d—–w- c:\docume~1\conwellc\applic~1\Windows Desktop Search 2010-06-22 01:34:53 0 d—–w- c:\windows\system32\GroupPolicy 2010-06-22 01:34:53 0 d—–w- c:\program files\Windows Desktop Search 2010-06-22 01:34:21 98304 -c—-w- c:\windows\system32\dllcache\nlhtml.dll 2010-06-22 01:34:21 29696 -c—-w- c:\windows\system32\dllcache\mimefilt.dll 2010-06-22 01:34:21 192000 -c—-w- c:\windows\system32\dllcache\offfilt.dll 2010-06-22 01:33:21 0 d—–w- c:\windows\system32\URTTEMP 2010-06-21 23:37:54 0 d—–w- c:\docume~1\conwellc\applic~1\SUPERAntiSpyware.com 2010-06-21 23:37:54 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2010-06-21 23:37:48 0 d—–w- c:\program files\SUPERAntiSpyware 2010-06-21 23:19:24 0 d—–w- c:\docume~1\conwellc\applic~1\Malwarebytes 2010-06-21 23:19:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-06-21 23:19:10 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-06-21 23:19:10 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-06-21 23:19:10 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-06-10 11:50:24 3253 —-a-w- c:\windows\system32\wbem\Outlook_01cb08931c9b191c.mof 2010-06-07 16:27:10 7680 –sha-w- c:\windows\Thumbs.db 2010-06-07 16:26:15 30720 —-a-w- C:\QDI Survey Form.doc 2010-06-04 00:56:41 60386 —-a-w- c:\windows\system32\DellSystem.xml 2010-06-04 00:56:35 0 —-a-w- c:\windows\invcol.tmp 2010-06-04 00:49:22 0 d—–w- C:\dell ==================== Find3M ==================== 2010-06-18 23:36:32 57007 —-a-w- c:\windows\fonts\AdobeFnt08.lst 2010-06-03 00:59:06 161920 —-a-w- c:\windows\system32\drivers\wpshelper.sys 2010-06-02 09:55:30 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll 2010-06-02 09:55:30 527192 —-a-w- c:\windows\system32\XAudio2_7.dll 2010-06-02 09:55:30 239960 —-a-w- c:\windows\system32\xactengine3_7.dll 2010-05-26 16:41:02 470880 —-a-w- c:\windows\system32\d3dx10_43.dll 2010-05-26 16:41:02 248672 —-a-w- c:\windows\system32\d3dx11_43.dll 2010-05-26 16:41:02 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll 2010-05-26 16:41:02 1998168 —-a-w- c:\windows\system32\D3DX9_43.dll 2010-05-26 16:41:02 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll 2010-05-06 10:41:53 916480 —-a-w- c:\windows\system32\wininet.dll 2010-05-02 05:22:50 1851264 —-a-w- c:\windows\system32\win32k.sys 2010-04-27 18:40:40 133616 ——w- c:\windows\system32\pxafs.dll 2010-04-27 18:40:40 126448 ——w- c:\windows\system32\pxinsi64.exe 2010-04-27 18:40:40 123888 ——w- c:\windows\system32\pxcpyi64.exe 2010-04-20 05:30:08 285696 —-a-w- c:\windows\system32\atmfd.dll 2010-04-12 22:29:19 411368 —-a-w- c:\windows\system32\deployJava1.dll ============= FINISH: 19:32:26.95 ===============

Attachments:

Post #2
Posted Image

I'm not sure we're going to be able to fix this but we'll give it a go.


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI